Morrison Supermarkets Liable for 2014 Data Leak, U.K. Judges Say

(Bloomberg) -- The grocery chain Wm Morrison Supermarkets Plc is liable for a major leak of personal data by a former IT worker, the U.K. appeals court ruled Monday, upholding a lower court’s finding.

More than 5,000 Morrisons workers are seeking compensation over the 2014 incident, in which their personal details were posted online. Morrisons fell as much as 1.8 percent in London.

Judge Brian Langstaff found last year -- in the first class action over a data leak -- that the retailer didn’t have “primary liability” but was vicariously liable. The U.K. Court of Appeal, in a decision Monday, upheld Langstaff’s ruling.

After the ruling, Morrisons emphasized that it hasn’t “been blamed by the courts for the way it protected colleagues’ data but they have found that we are responsible for the actions” of its former employee. The retailer is planning to appeal to the Supreme Court.

“Morrisons worked to get the data taken down quickly, provide protection for those colleagues and reassure them that they would not be financially disadvantaged,” a spokesman for the company said.

Former employee Andrew Skelton, a senior IT auditor at the company, leaked payroll data of almost 10,000 employees in 2014. He’s been convicted over the data leak and sentenced to an eight-year prison term.

To contact the reporter on this story: Kaye Wiggins in London at kwiggins4@bloomberg.net

To contact the editor responsible for this story: Anthony Aarons at aaarons@bloomberg.net

©2018 Bloomberg L.P.